Q: What causes Domain Separation Not Filtering Records Correctly?

Record sys_domain field set to Global or incorrect domain — Check the sys_domain field on the affected records - it's likely set to 'global' or a different domain than expected. Navigate to the record and look at the sys_domain field value in the form header or sys_domain column in list view. User sys_domain field doesn't match their intended domain — Check the user's sys_domain field in sys_user table. Navigate to User Administration > Users, find the affected user, and verify their sys_domain field matches the domain they should have access to. Domain visibility settings allowing child domain access to parent records — Check the 'Can see parent' field on the domain record in sys_user_group_type table. This is often expected behavior but can be confusing - child domains inherit visibility to parent domain records by design. Business Rule setting sys_domain incorrectly on record creation — Check for Business Rules on the affected table that modify sys_domain field during insert/update. Look in System Definition > Business Rules and filter by the table name, then examine any rules that reference sys_domain. ACL overriding domain separation filtering — Check for custom ACLs on the affected table that might be overriding domain filtering. Navigate to System Security > Access Controls (ACL), filter by table name, and look for rules with custom conditions that bypass domain checks.

Question 1

What causes Domain Separation Not Filtering Records Correctly?

Accepted Answer

Record sys_domain field set to Global or incorrect domainhigh likelihood

Check the sys_domain field on the affected records - it's likely set to 'global' or a different domain than expected. Navigate to the record and look at the sys_domain field value in the form header or sys_domain column in list view.

User sys_domain field doesn't match their intended domainhigh likelihood

Check the user's sys_domain field in sys_user table. Navigate to User Administration > Users, find the affected user, and verify their sys_domain field matches the domain they should have access to.

Domain visibility settings allowing child domain access to parent recordsmedium likelihood

Check the 'Can see parent' field on the domain record in sys_user_group_type table. This is often expected behavior but can be confusing - child domains inherit visibility to parent domain records by design.

Business Rule setting sys_domain incorrectly on record creationmedium likelihood

Check for Business Rules on the affected table that modify sys_domain field during insert/update. Look in System Definition > Business Rules and filter by the table name, then examine any rules that reference sys_domain.

ACL overriding domain separation filteringlow likelihood

Check for custom ACLs on the affected table that might be overriding domain filtering. Navigate to System Security > Access Controls (ACL), filter by table name, and look for rules with custom conditions that bypass domain checks.

Question 2

How do you fix Domain Separation Not Filtering Records Correctly?

Accepted Answer

How to fix it

Verify the affected user's domain assignment. Navigate to User Administration > Users, open the user record, and check the Domain field. It should match their intended domain, not global.
Check the sys_domain field on the problematic records. Navigate to the affected table, add the Domain column to the list view by right-clicking column headers and selecting Configure > List Layout.
For records with incorrect sys_domain values, update them using a bulk update. Create a filter for the records, then use Update Multiple Records from the list's context menu to set the correct domain.

⚠️

Always test domain changes in a sub-production instance first. Incorrect domain assignments can break integrations and workflows.

Check domain visibility settings by navigating to System Definition > Domain Map. Open the relevant domain record and review the Can see parent checkbox. If checked, child domains will see parent domain records.
Identify problematic Business Rules by going to System Definition > Business Rules. Filter by Table equals your affected table name. Review any rules that run on insert/update.
Examine Business Rule scripts for sys_domain assignments. Look for lines like current.sys_domain = 'global' or current.setValue('sys_domain', 'some_domain'). These may be overriding the correct domain.
Fix problematic Business Rules by either removing the sys_domain assignment or using gs.getUser().getDomainID() to set the domain based on the current user's domain instead of hardcoding it.
Check for custom ACLs that might bypass domain filtering. Navigate to System Security > Access Controls (ACL) and filter by your table name. Look for read operations with custom conditions.
Review ACL conditions for domain bypass logic. Look for conditions that use gs.nil(current.sys_domain) or explicitly check for global domain without proper domain separation logic.
Test the fix by logging in as a user from the affected domain and verifying they can only see appropriate records. Use System Administration > Users > Impersonate User for testing.

💡

Enable domain separation debug logging by setting com.snc.domain_separation to Debug level in System Logs > Log Levels to trace domain filtering issues.

Question 3

How do you prevent Domain Separation Not Filtering Records Correctly?

Accepted Answer

Always include domain-aware logic in custom Business Rules by using gs.getUser().getDomainID() instead of hardcoding domain values. Set up a scheduled job to audit sys_domain field values across critical tables and alert when records have unexpected domain assignments. Create ACL validation rules that prevent users from modifying sys_domain fields unless they have the domain_admin role. Document domain visibility settings clearly and include domain inheritance rules in your instance's technical documentation. Test all integrations and data imports with domain separation enabled to ensure they respect domain boundaries and don't create global records unintentionally.

Domain Separation Not Filtering Records Correctly

Symptom

Possible Causes

Debugging this in a real instance?

Solution

How to fix it

Prevention Tips

Test Your Knowledge